Bolt + Supabase: new row violates row-level security policy for table "profiles"

The policy is fine, the timing isn't. If "Confirm email" is on in Supabase Auth, signUp() returns a user but no session. Your insert right after runs as anon, so auth.uid() is null and the check fails.

Cleanest fix: create the profile in the database with a trigger, so the client never has to:

create function public.handle_new_user()
returns trigger language plpgsql security definer set search_path = ''
as $$
begin
  insert into public.profiles (id, username)
  values (new.id, new.raw_user_meta_data->>'username');
  return new;
end;
$$;

create trigger on_auth_user_created
  after insert on auth.users
  for each row execute function public.handle_new_user();

Pass username via options.data in signUp. Remove the client-side insert.

And good call not disabling RLS.